OhSINT — OSINT Reconnaissance Orchestrator

73 tools. 5 pipelines. One interface. CLI + MCP server.

Unified OSINT reconnaissance for authorized engagements. Wraps 73 tools behind smart target detection, parallel execution, deduplication, and multi-format reporting (JSON / Markdown / HTML). Runs on Kali Linux; connects to Claude Desktop/Code via an MCP server.

Pipelines

Five multi-stage pipelines chain tools with data flowing between stages:

Pipeline	Command	What it does
Subdomain Takeover	`ohsint takeover`	subfinder + crt.sh → dnsx CNAME → provider filter → subzy + nuclei → cross-validate
Historical URL Harvest	`ohsint url-harvest`	gau + waybackurls + waymore → dedupe → gf pattern match → robots.txt history
Secret Surface	`ohsint secret-surface`	GitHub / Docker Hub / Postman search → TruffleHog + Gitleaks → cross-validate
JS Analysis	`ohsint js-analysis`	subjs + katana → download → beautify → LinkFinder + SecretFinder → source maps → Swagger
Full Passive	`ohsint passive-full`	chains all 4 above with cross-pipeline data flow

Quick Start

# Install the CLI + MCP entry points
pip install -e . --break-system-packages

# Install all tool binaries (Kali VM — handles every install gotcha)
bash scripts/setup-kali.sh

# Verify tools, API keys, OPSEC config
ohsint install-check
ohsint opsec-check

# Run a pipeline
ohsint takeover -t example.com
ohsint passive-full -t example.com

# Multi-target / scope file
ohsint takeover --scope-file hackerone_scope.txt
ohsint takeover -t a.com -t b.com -t c.com

# Start the MCP server (see docs/mcp-setup.md for binding/IP)
ohsint-mcp --host <vm-ip>

OPSEC / Analyst Protection

Optional protection layer, configured in configs/opsec.yaml:

Request hygiene — User-Agent rotation, per-host rate limiting, cookie suppression on all direct HTTP calls
Proxy egress — optional SOCKS5/HTTP/Tor routing for tool subprocesses
Session isolation — random-suffixed output dirs so concurrent scans don't collide

Verify with ohsint opsec-check. For container-based isolation, see docs/kasm-deployment.md.

Authorization

Passive tools run freely. Active tools (httpx, naabu, shuffledns, interactsh, spiderfoot, recon-ng, xray, linkedin2username, linkedint) require --authorization. FCRA-gated commercial identity tools require --fcra-permissible-purpose.

Docs

Tool reference: docs/tools.md
MCP setup & Kali install: docs/mcp-setup.md
Deployment gotchas: tasks/lessons.md
Usage guidelines & tool chaining: CLAUDE.md

API Keys

Configure in configs/api_keys.yaml (copy from configs/api_keys.yaml.example). Check status: ohsint api-keys.

License

MIT

OhSINT MCP Server